Repository navigation
fix(deps): update fabric8-kubernetes-client monorepo to v8 - #684
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.6.1→8.0.07.6.1→8.0.07.6.1→8.0.0Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
fabric8io/kubernetes-client (io.fabric8:kubernetes-httpclient-okhttp)
v8.0.0Compare Source
Bugs
Object, rawMap,List<Object>, raw collection,@JsonUnwrappedand polymorphic properties keep their content, and date and time types only declare a format their values match (Duration,LocalDateTimeand the partial types losedate-time).Optionalproperties get their value type's schema instead of preserving unknown fields, see the migration guideWWW-Authenticateheader, which is how the API server sends them, are returned with their body instead of failing with "HTTP protocol violation: Authentication challenge without WWW-Authenticate header"Proxy-Authorizationrequest header that HTTPS requests carry through the proxy tunnel to the API servernull, and a proxy URL with a user and no password asuser:instead ofuser(RFC 7617)onError, the returned future already fails with it. When the handshake was retried, this ended watches and exec/attach sessions before the retry could open themBasic user:passwordare only added as aProxy-Authorizationheader to the requests an HTTP proxy reads. HTTPS and WSS requests, WebSockets that Vert.x tunnels, and requests through a SOCKS proxy carried them to the API serverBasic user:passwordare sent to the HTTP proxy by Vert.x, on the CONNECT too, so HTTPS and WebSocket requests through a proxy that requires them work, and they no longer reach the API serverpods/proxyfor example) is no longer answered with the proxy credentials, which went through the proxy tunnel to it, and credentials the proxy rejected aren't sent againIOException, and is retried, instead of hanging until the request timeout (seen on Windows)java.sql.Datewritten asyyyy-MM-ddis read as a local date instead of the previous day west of UTC.Year,Month,java.sql.DateandLocalekeep their 7.x wire format, mappers you build yourself need the newJackson2JdkTypesModule, see the migration guidebyte[],ByteBuffer,char[],Yearandjava.sql.Dateschemas match what the client writes (byte[]andByteBufferareformat: bytestrings), so the API server no longer rejects them.@PrinterColumnon aLocalDateis astringcolumn instead of adatecolumn that showed<invalid>InputStreambody andExpect: 100-continue(binary builds) no longer hang, and anInputStreambody of known length is sent withContent-Lengthinstead of chunkedConfig#websocketPingInterval(30s by default), like OkHttp already did, so load balancers that close idle connections no longer drop quiet watchesImprovements
int/Integerandlong/Longproperties getformat: int32andformat: int64, like controller-genwithShardSelectoraccepts a typedShardSelector(ShardSelector.builder().addShard(0, 4).addShard(2, 4).build()) next to the raw expressionString, so theshardRange(...)CEL grammar and its hexadecimal bounds don't have to be written by handDependency Upgrade
4db47f5tod70b66a1cb53e3(release-4.19) to231177c(release-4.22)0e03b7ato5c4a396698e349to61de77e2ed182bto039bae92d25383to8104fcf6a13204toea34ca30d7e21cto5341d763a17a1ato553f19cc3e46b4to30a5420030a382to8d84710New Features
certificates().v1().podCertificateRequests(),dynamicResourceAllocation().v1().deviceTaintRules(),storageMigration().v1().storageVersionMigrations()andscheduling().v1beta1()podGroups()andworkloads(), pluscertificates().v1beta1().podCertificateRequests()andstorageMigration().v1beta1().storageVersionMigrations().kubernetes-model-policyalso ships thelifecycle.k8s.io/v1alpha1model (EvictionandEvictionRequest)Note: Breaking changes
runtimeClasses()andnetwork().ingresses()(andnetwork().ingress()) use thev1models instead ofv1beta1ones Kubernetes no longer serves, see the migration guidetools.jacksoncoordinates and packages). The default serialization keeps the Jackson 2 behavior for custom types, see the migration guideFilterable#withShardSelectoralso accepts a typedShardSelector, so a literalwithShardSelector(null)no longer compiles, see the migration guidecrd-generator-apiandcrd-generator-apt). Migrate tocrd-generator-api-v2with the Maven plugin, the CLI tool, or the Gradle build script recipe, see the migration guideosgi.ee=JavaSE 17kubernetes-karaffeature repository no longer defines its ownscrfeature.kubernetes-clientnow depends on thescrfeature provided by the Karaf distribution, which supplies the Declarative Services API bundles and thescr:*shell commandsRevisionSpecreplacesworkloadRefwithschedulingGroupand addsevictionResponders, like the corePodSpecsince Kubernetes 1.37DiscoveredClusterSpecdropsownerandDiscoveredClusterConditiondropslastUpdateTimeio.fabric8.openshift.api.model.customresourcestatus.conditions.v1.Conditionremoved, HiveClusterDeploymentCustomizationStatusconditions use the KubernetesConditionClusterImagePolicySpecandImagePolicySpecpolicies areImageSigstoreVerificationPolicyand their roots of trustImagePolicyFulcioCAWithRekorRootOfTrust,ImagePolicyPKIRootOfTrustandImagePolicyPublicKeyRootOfTrust. Model classesFulcioCAWithRekor,PKI,PolicyandPublicKeyremovedGCPPlatformStatusdropsserviceEndpoints, model classGCPServiceEndpointremovedClusterDeprovisionPlatform,MachinePoolPlatformandPlatformdropovirt, model classesOvirtClusterDeprovisionand theio.fabric8.openshift.api.model.hive.ovirt.v1package removedMachinePool.osDiskuses the installerio.fabric8.openshift.api.model.installer.vsphere.v1.OSDisk, model classio.fabric8.openshift.api.model.hive.vsphere.v1.OSDiskremoved. The module now depends onopenshift-model-installer,openshift-model-machineandopenshift-model-operatorPSCEndpointdropsregionv1alpha1model classesMachineConfigNode,PinnedImageSetand their related types removed, use thev1onesMultiClusterHubSpecdropscustomCAConfigmap,enableClusterBackup,enableClusterProxyAddon,hive,ingressandseparateCertificateManagement. Model classesBackupConfig,ExternalDNSAWSConfig,ExternalDNSConfig,ExternalDNSGCPConfig,FailedProvisionConfig,HiveConfigSpec,HiveConfigStatus,IngressSpecandVeleroBackupConfigremovedPlatformMetricsSpecandUserWorkloadMetricsSpecreplacecollectionwithdefault(PlatformMetricsCollectionSpecandUserWorkloadMetricsCollectionSpecremoved), andPlatformNamespaceRightSizingRecommendationSpecis renamed toPlatformRightSizingRecommendationSpecTemplateandAffinityAssistantTemplatemoved from packageio.fabric8.tekton.podtoio.fabric8.tekton.unversioned, since tekton pipeline 1.16.0 declares them as+versionName=unversionedkubernetes-clientandopenshift-clientdefault to the Vert.x 5 HttpClient (kubernetes-httpclient-vertx-5) instead of Vert.x 4 (kubernetes-httpclient-vertx), see the migration guidev7.9.0Compare Source
Bugs
exec/attach/portForward/WebSocket-backed watches) on a derived client - one produced by callingnewBuilder()/build()on an already-builtHttpClient- no longer fall back to Vert.x's bareWebSocketClientdefaults.Vertx5HttpClientBuilder.build()'s short-circuit path for derived clients reused the original client's plain HTTP connection (with its configuration intact) but always created a brand-newWebSocketClientwith no options at all, discarding both the trust/key material (so TLS verified against the JVM default trust store instead of the configured cluster CA) and the configured limits (maxFrameSize/maxMessageSizefell back to 64 KiB/256 KiB instead of unlimited, andmaxConnectionsto 50 instead of 8192, so oversizedexec/attachmessages were silently dropped even on plain HTTP). This affectskubernetes-httpclient-vertx-5only, which is opt-in - the bundled defaultkubernetes-httpclient-vertx(Vert.x 4) serves WebSockets from the same client it reuses when deriving and was never affected - and it is present in 7.6.0 through 7.8.0. Derivation happens more often than it looks:OpenShiftClientImplderives on everyadapt(OpenShiftClient.class)to install its OAuth token-refresh interceptor,OpenShiftOAuthInterceptorderives on every token refresh, andBaseClient#newClientderives whenever a differingRequestConfigis set. Derived clients now reuse the original'sWebSocketClientoutright, the same way they already reused its HTTP client, so they can no longer drift from it and no second transport is allocated per derivation. Note that sharing the transport also means closing any client in a derived family closes it for the whole family:close()on a client obtained fromadapt(OpenShiftClient.class)now ends WebSocket operations on the client it was derived from as well, which is already what happened to that client's HTTP requests and what the other four implementations do. Nothing usable is lost, since the original's HTTP client was closed regardless; what changes is that the per-derivationWebSocketClientis no longer left behind unclosedexec/attach/portForwardand WebSocket-backed watches no longer connect straight to the API server and bypass a mandated egress proxy. Both implementations serve WebSockets from a transport separate from the HTTP client (a Vert.x 5WebSocketClient, and a second JettyHttpClientbehind theWebSocketClient) and neither was given the proxy configuration; Jetty's WebSocket transport now also receives the proxyBasicAuthenticationentry. The OkHttp, JDK and Vert.x 4 modules were unaffected because a single client serves both. Onhttpclient-vertx-5the configured connect timeout was not applied to the WebSocket client either, so a WebSocket connect could hang well past it. One consequence worth calling out: when the proxy credentials cannot be decoded -HttpClientUtils.decodeBasicCredentialsreturnsnullfor anything that is notBasic, or whose decoded value does not split into exactly two:-separated parts, so a proxy password containing a colon is enough - the client falls back to stampingProxy-Authorizationon the request instead of configuring it on the transport. Such WebSocket connections now reach the proxy and are rejected with a 407 rather than silently completing straight to the API server, so a setup that appeared to work only because it was bypassing the proxy will now failKUBE_API_TEST_STARTUP_TIMEOUTenvironment variable is now parsed instead of throwingClassCastExceptionon every use — the value (always aString) was passed toClass.cast()for anInteger/Booleantarget, which only widens reference types and never parses, so the timeout could not be configured via environment at all. A newstartupTimeoutattribute on@EnableKubeAPIServer(e.g.@EnableKubeAPIServer(startupTimeout = 180000)) allows overriding it declaratively, and all three configuration paths (annotation, builder, env var) now reject non-positive valuesHttpServerRequest#body()callback. Deferring the upgrade let the request end event be processed first, soHttpServerRequest#toWebSocket()intermittently threwIllegalStateException: Request has already been readand the upgrade was lost (surfacing as flakyexec/attachmock-server tests). Upgrade requests carry no body, so they are detected via theUpgradeheader and upgraded before the request is read; the asynchronous path is unchanged for regular HTTP requestsjavacdecodes it. As a defense in depth, each generated class is also re-parsed and structurally validated before it is written (with Java Unicode escape preprocessing enabled to matchjavac), aborting generation on any residual structural mismatchopenshift-modelno longer bundles theio.fabric8.openshift.api.model.config.*classes thatopenshift-model-configowns (itsExport-Packagewildcard inlined them from that dependency); they still reach consumers through it.Fabric8ClientInjectionHandlermoved toio.fabric8.kubeapitest.junit.injectImprovements
Dependency Upgrade
New Features
v1.TCPRouteandv1.UDPRoute(both graduated fromv1alpha2upstream in gateway-api v1.6.0). Thev1alpha2types remain available, but upstream has deprecated them and will remove them in a future release, so new code should use thev1typesNote: Breaking changes
certificates.k8s.io/v1alpha1/ClusterTrustBundle→ usecertificates.k8s.io/v1orv1beta1networking.k8s.io/v1beta1/IPAddress→ usenetworking.k8s.io/v1networking.k8s.io/v1beta1/ServiceCIDR→ usenetworking.k8s.io/v1storage.k8s.io/v1beta1/VolumeAttributesClass→ usestorage.k8s.io/v1scheduling.k8s.io/v1alpha2(entire API version, 28 types) → usev1alpha3orv1beta1VolumeMountconstructor signature changed (Kubernetes v1.37.0 addedbindMountOptionsfield). The canonical constructor now takesbindMountOptions(List) as its first parameter. Builder usage (new VolumeMountBuilder().with...()) is unaffectedv1.SessionPersistenceno longer exposesidleTimeout(removed upstream in gateway-api v1.6.0). Besides the field, this removesgetIdleTimeout()/setIdleTimeout(), collapses the canonical constructor from five arguments to four, and dropsSessionPersistenceFluent.withIdleTimeout()/getIdleTimeout()/hasIdleTimeout(), so the builder form (withNewSessionPersistence().withIdleTimeout(...)) no longer compiles. There is no runtime data loss: the class keeps its@JsonAnyGetter/@JsonAnySetter, and both the fluent and the builder carryadditionalPropertiesthrough, so JSON or YAML still containingidleTimeoutcontinues to deserialize and re-serialize intactFabric8ClientInjectionHandlermoved toio.fabric8.kubeapitest.junit.inject. It is resolved throughServiceLoader, so only code naming the class directly is affectedio.fabric8.openshift.api.model.config.*. Maven consumers are unaffected (openshift-model-configis a compile dependency), but OSGi deployments importing those packages must install theopenshift-model-configbundle, which theopenshift-clientKaraf feature already doesv7.8.0Compare Source
Bugs
GET.JdkHttpClientImpl.requestBuilderonly calledHttpRequest.Builder.method(...)inside thebody != nullbranch, so a bodylessDELETE/POST/PUT/PATCH(such asclient.raw(uri, "DELETE", null)) was sent asGETon the JDK backend; the method is now set withBodyPublishers.noBody()when there is no body, matching the OkHttp, Jetty and Vert.x backendsSharedIndexInformer's periodic resync no longer stops permanently and silently when a single resync cycle throws.DefaultSharedIndexInformer.scheduleResyncruns the resync throughUtils.scheduleAtFixedRate, whose self-rescheduling chain re-arms the next cycle only when the previous one completes normally; an uncaught exception completed the (unobserved)resyncFutureexceptionally and the resync was never scheduled again, with no log, while the independent watch keptisWatching()reportingtrue(a restart was required to recover). The resync command now catches andWARN-logs the failure so the schedule fires again at the next intervalStandardHttpClient.shouldRetrybackoff loop (~19 s drain). The classifier walks bothgetCause()andgetSuppressed()trees forCertificateException,CertPathValidatorException,CertPathBuilderException, andSSLPeerUnverifiedException. Affects all five HTTP client modules (jdk, jetty, okhttp, vertx-4, vertx-5) on both the HTTP request and WebSocket connect pathsWatchEventsListenernow buffers outgoing watch events that are scheduled before Vert.x firesonOpenand replays them once the WebSocket is available, closing the open-side race where a CRUD operation landing betweenhandleWatchregistering the listener andonOpenpopulatingwebSocketRefscheduled a send that dereferenced a nullwebSocketRef; the resultingNullPointerExceptionwas silently swallowed by the executor and the event was dropped. Buffered events are replayed after the initial-syncADDEDs so ordering is preservedAbstractWatchManager.watchEnded()now emits aWatcherExceptionwhen a watch closes cleanly with no messages within 2 seconds, compensating for a GKE-specific behaviour onv1/eventswhere the GKFE proxy rejects a staleresourceVersionwith a bare WebSocket close (code 1000, no body) instead of{"type":"ERROR","code":410}, causing an indefinite reconnect loop with the same stale resourceVersionexec/attach/portForward/WebSocket-backed watches, and the CRD-establishment waits that depend on them) now trust the cluster certificate again. Vert.x 5.1 rewrote the WebSocket client to resolve TLS through a per-connectionClientSSLOptionsthat ignored the customSslContextFactorythe client used as its sole carrier of trust material, so WebSocket handshakes silently fell back to the default JVM trust store, failed PKIX validation, and hung to the client-side timeout (regular HTTPS request/response was unaffected). Both the HTTP and WebSocket clients are now configured uniformly with Vert.xTrustOptions/KeyCertOptionsderived from the supplied trust/key managersUtils.findFreePortnow records every port it hands out for the JVM's lifetime and skips any port already returned, eliminating the back-to-back duplicate-port window that surfaced as aJUnitExtensionOnMethodTest.simpleTest2flake — the probeServerSocketwas closed before the caller bound it, soEtcdProcess.startEtcd()andKubeAPIServerProcess.startApiServer()could draw the same port fromRandom.nextInt, etcd would win the bind, and apiserver would exit 1 withbind: address already in use, surfacing inProcessReadinessCheckerasConnection reset by peerWatchEventsListener.onClosingnow queues the server-sideWebSocket.close(...)on the listener's send executor instead of invoking it directly on the Vert.x event loop. This preserves FIFO ordering with any data frames already queued on that executor, so events scheduled before a client-initiated watch close (e.g. anADDED/DELETEDpair on a finalcreate/deletebeforewatch.close()) are delivered before the close frame instead of being silently dropped by writes against an already-closing socketInterruptedExceptionwithout preserving the interrupt status (S2142)Dispatchershutdown into two phases soMockDispatcheronly tears down per-sessionWebSocketSessionexecutors after the HTTP server has drained, removing the window where an in-flight upgrade'sonOpencould land on a shut-down executor.shutdown()still runs beforehttpServer.close()to unblock blocked dispatches (e.g.QueueDispatcher.take()); the newreleaseResources()runs after.WebSocketSession.send()additionally catchesRejectedExecutionExceptiondefensively so any residual shutdown race stays silent instead of bubbling as a Vert.xUnhandled exception.KubernetesMixedDispatchernow delegates both lifecycle hooks to its innerMockDispatcher, fixing a pre-existing leak where CRUD-mode WebSocket session executors were never shut downterminateOnError/ channel-3 exit-status completion —listener.onFailure(oronClose) fires exactly once, gated by a dedicated flag, instead of being silently swallowed when the deferred onError task observesexitCode.isDone()BaseOperation.informOnConditionnow stops the informer inline when the inner predicate completes the future, closing a CompletableFuturepostCompleterace where a waiter helping drain dependents could fireinformer.stopaftercf.completehad already triggered a spurious?watch=trueHTTP requestBaseClient.addToCloseablenow synchronizes on the internal closeable set rather than the caller-supplied parameter, so callers cannot break mutual exclusion by passing different references (sonar S2445)KUBERNETES_SUBDOMAIN_REGEXuses possessive quantifiers on the outer groups to block ReDoS-style backtracking on adversarial subdomain input; semantics still match the canonical RFC 1123 subdomain pattern (sonar S5998)Serialization.yamlMapperbuilds the mapper into a local before assigning to thevolatilefield, so concurrent readers can no longer observe a partially-initialized instance with modules not yet registered (sonar S3064)Files.deleteIfExistswith logging instead of swallowing theFile.delete()return value (sonar S899)OkHttpClientBuilderImplnow picks the firstX509TrustManagerfrom a multi-entryTrustManager[]rather than passingnullto OkHttp'ssslSocketFactoryand NPE'ing; user-suppliedsslContextis preserved for multi-CA setups (sonar S2637)OkHttpClientImpl.doCloseremoves dead null checks ondispatcherandconnectionPoolthat are guaranteed non-null by the OkHttp API (sonar S2583)Improvements
MockWebServer.dispatcherfield markedvolatileso asetDispatcher(...)call is reliably visible to the Vert.x request handler thread without further synchronization.MockWebServer.reset()Javadoc tightened to make its non-destructive contract explicit (no change to the running server, dispatcher, listeners, SSL/TLS state, port, or protocols)Dependency Upgrade
New Features
Vertx5HttpClientFactory/VertxHttpClientFactorynow exposesetTlsWarmup(TlsWarmup)with modesOFF,CONTEXT(default, unchanged) andFULL.FULLruns a synchronous, once-per-JVM, throwaway loopback TLS handshake off the event loop when the client is built, so the first real connection no longer blocks the event loop on the one-time JDK/Netty TLS class loading — for users on cold or hard-CPU-throttled JVMs hitting the first-connection block/timeout described in #7921. Default behavior is unchanged; see the FAQ for CDS and pod CPU-sizing guidance for hard-throttled podsNote: Breaking changes
v7.7.0Compare Source
Bugs
<,>, and&in CRD descriptions to produce valid JavadocImprovements
HasMetadata#isSameResourceto test whether two HasMetadata instances point to the same logical cluster resource, with an optional strict mode that also requires matching kind and resourceVersionMockWebServer#setHttp2ClearTextEnabled(boolean)setter to opt out of HTTP/2 cleartext (h2c) upgradeDependency Upgrade
New Features
subresource()methodNote: Breaking changes
scheduling.k8s.io/v1alpha1model classes removed (Workload,WorkloadList,WorkloadSpec,PodGroup,PodGroupPolicy, `BasicScConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.